Fallos del tipo CWE-23

509 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2021-41178HIGHFile Traversal affecting SVG files on Nextcloud ServerEPSS 1.8%CVE-2025-55748CRITICALXWiki Platform's configuration files can be accessed through jsx and sx endpointsEPSS 1.8%CVE-2022-23732—Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protectionsEPSS 1.7%CVE-2023-20066MEDIUMCisco IOS XE Software Web UI Path Traversal VulnerabilityEPSS 1.7%CVE-2025-55747CRITICALXWiki Platform's configuration files can be accessed through the webjars APIEPSS 1.7%CVE-2019-3976—RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgradeEPSS 1.7%CVE-2025-46002MEDIUMAn issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanEPSS 1.7%CVE-2019-11826HIGHRelative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users EPSS 1.7%CVE-2025-59341HIGHLocal File Inclusion in esm.shEPSS 1.6%CVE-2019-13944—A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versiEPSS 1.6%CVE-2025-52207CRITICALPBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.EPSS 1.6%CVE-2020-25150HIGHB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusEPSS 1.5%CVE-2022-38205HIGHPortal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)EPSS 1.5%CVE-2020-10631—An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.EPSS 1.5%CVE-2024-20352MEDIUMA vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which coEPSS 1.5%CVE-2022-20862MEDIUMCisco Unified Communications Manager Arbitrary File Read VulnerabilityEPSS 1.5%CVE-2020-7861HIGHAnySupport directory traversing vulnerabilityEPSS 1.5%CVE-2021-41242HIGHPath Traversal in some REST methods leading to file upload to arbitrary placesEPSS 1.4%CVE-2020-3597MEDIUMCisco Nexus Data Broker Software Path Traversal VulnerabilityEPSS 1.4%CVE-2022-39345CRITICALGin-vue-admin arbitrary file upload vulnerability caused by path traversalEPSS 1.4%